@net-mesh/browser 0.41.1 → 0.43.0

package/dist/leader/session.d.ts

@@ -57,7 +57,10 @@ export interface SessionOptions extends ConnectOptions {
     dbName?: string;
     /**
      * Override the Web Lock and `BroadcastChannel` name. Defaults to
-     * `net-mesh/<origin>/<identity-fingerprint>`.
+     * `net-mesh/<origin>/<identity-fingerprint>`, or — with a custodial
+     * `entitySecretHex` — to the identity lock `connect()` takes for that
+     * secret, so a `connect()` tab and an `openSession()` tab cannot both run
+     * the identity. Setting it opts out of that contention.
      *
      * For tests that need two independent elections inside one origin.
      * A page should not set it: two scopes on one identity is two nodes
@@ -65,7 +68,6 @@ export interface SessionOptions extends ConnectOptions {
      */
     lockScope?: string;
 }
-/** The origin's Net node, as this tab sees it. */
 export declare class MeshSession {
     private readonly inner;
     /**

package/dist/leader/session.js

@@ -28,7 +28,7 @@
  */
 import { fromWasmError, OrgCancelledError, OrgLeaderLostError, } from '../errors.js';
 import { clientStreamOrgTrampoline, duplexOrgTrampoline, OrgDuplex, OrgHandleRegistry, OrgServe, OrgStream, OrgUpload, streamingOrgTrampoline, toWasmOrgCallOptions, toWasmOrgServeOptions, unaryOrgTrampoline, } from '../org.js';
-import { buildConnectRequest, parseAttemptStatus, parseCounters, parseDescriptors, } from '../node.js';
+import { buildConnectRequest, identityLockName, parseAttemptStatus, parseCounters, parseDescriptors, } from '../node.js';
 import { acceptPeer as driveAccept, answerWaitingOffer, connectPeer as driveConnect, noteOffer, PeerAttempts, } from '../peer-driver.js';
 import { LeafStream } from '../stream.js';
 import { idArg, loadLeafWasm } from '../wasm.js';
@@ -36,6 +36,13 @@ import { isLifecycleEvent, parseSessionEvent, } from './events.js';
 import { asSessionModule } from './wasm.js';
 import { EventHub } from '../events.js';
 /** The origin's Net node, as this tab sees it. */
+/**
+ * What a send on a stream ended by a leader change fails with. Worded
+ * the way the leaf words a stale handle, because `isStaleStream` (the
+ * store's reopen test) matches exactly that: a store over a session
+ * reopens on the new leader rather than counting `send-failed` forever.
+ */
+const STALE_AFTER_HANDOFF = 'stale stream handle: the leader changed; reopen the stream';
 export class MeshSession {
     inner;
     /**
@@ -100,7 +107,7 @@ export class MeshSession {
                 // The generation that owned the calls is the one they were
                 // issued under — typed `LeaderLost`, never resumed.
                 this.orgHandles.retireAll(new OrgLeaderLostError(this.streamGeneration));
-                this.endStreams();
+                this.endStreams(STALE_AFTER_HANDOFF);
                 return;
             }
             // And the abrupt case: a generation that moved under us. Read
@@ -114,7 +121,7 @@ export class MeshSession {
             const previous = this.streamGeneration;
             this.streamGeneration = current;
             this.orgHandles.retireAll(new OrgLeaderLostError(previous));
-            this.endStreams();
+            this.endStreams(STALE_AFTER_HANDOFF);
         });
     }
     /** `'leader'` if this tab runs the node, `'follower'` if another does. */
@@ -725,11 +732,17 @@ export class MeshSession {
      * on close; idempotent, because a page may have closed a stream
      * itself.
      */
-    endStreams() {
+    endStreams(staleReason) {
         const open = [...this.streams];
         this.streams.clear();
-        for (const stream of open)
-            stream.close();
+        for (const stream of open) {
+            // A leader change retires with the reopenable wording; closing the
+            // session is permanent.
+            if (staleReason === undefined)
+                stream.close();
+            else
+                stream.retire(staleReason);
+        }
     }
     /**
      * Re-type whatever the boundary threw.
@@ -777,6 +790,17 @@ export async function openSession(options) {
         ...(options.dbName === undefined ? {} : { dbName: options.dbName }),
         ...(options.lockScope === undefined ? {} : { lockScope: options.lockScope }),
     };
+    // A custodial identity elects under the same lock name `connect()` takes
+    // for it, so mixed connect()/openSession() tabs with one secret cannot
+    // both run a node (cubic review of PR #1228). The scope also names the
+    // `BroadcastChannel`, and every session tab with that secret derives the
+    // same name, so the leader and its followers still meet.
+    // `lockIdentity: false` keeps the leaf's own default scope.
+    if (request.lockScope === undefined && request.entitySecretHex !== undefined && options.lockIdentity !== false) {
+        const shared = await identityLockName(request.entitySecretHex);
+        if (shared !== null)
+            request.lockScope = shared;
+    }
     try {
         return new MeshSession(await module.MeshSession.open(request));
     }

package/dist/lobby.js

@@ -46,7 +46,7 @@
  * tags the node should keep announcing as `tags`.
  */
 import { StoreError } from './store/errors.js';
-import { hostInternals, hostStore, } from './store/host.js';
+import { hostInternals, hostStore, nodeHexOf, } from './store/host.js';
 import { joinStore } from './store/join.js';
 import { hostPlayer } from './store/player.js';
 export class LobbyError extends Error {
@@ -215,10 +215,14 @@ function decodeRecord(game, tag) {
         return null;
     }
 }
+// Read the id the way every other caller-held id is read (`nodeHexOf`):
+// sixteen hex digits are hex, and anything shorter may be the exact-decimal
+// `peerNode` an event handed the page. Reading every digit run as hex kicked
+// a DIFFERENT id and removed nobody (SDK audit 2026-10-11).
 function hexPeer(peer) {
-    const raw = peer.startsWith('0x') ? peer.slice(2) : peer;
-    if (/^[0-9a-fA-F]{1,16}$/.test(raw))
-        return raw.toLowerCase().padStart(16, '0');
+    const hex = nodeHexOf(peer);
+    if (hex !== null)
+        return hex;
     throw new LobbyError('invalid', `not a peer id: ${JSON.stringify(peer)}`);
 }
 /**

package/dist/net_leaf.d.ts

@@ -1453,16 +1453,16 @@ export interface InitOutput {
     readonly proxystream_send: (a: number, b: number) => number;
     readonly proxystream_stream_id_hex: (a: number, b: number) => void;
     readonly start: () => void;
-    readonly __wasm_bindgen_func_elem_6504: (a: number, b: number, c: number, d: number) => void;
-    readonly __wasm_bindgen_func_elem_6506: (a: number, b: number, c: number, d: number) => void;
-    readonly __wasm_bindgen_func_elem_2365: (a: number, b: number, c: number) => number;
-    readonly __wasm_bindgen_func_elem_2366: (a: number, b: number, c: number) => void;
-    readonly __wasm_bindgen_func_elem_2366_112: (a: number, b: number, c: number) => void;
-    readonly __wasm_bindgen_func_elem_2366_113: (a: number, b: number, c: number) => void;
-    readonly __wasm_bindgen_func_elem_2366_114: (a: number, b: number, c: number) => void;
-    readonly __wasm_bindgen_func_elem_2366_115: (a: number, b: number, c: number) => void;
-    readonly __wasm_bindgen_func_elem_2366_116: (a: number, b: number, c: number) => void;
-    readonly __wasm_bindgen_func_elem_2366_117: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_6508: (a: number, b: number, c: number, d: number) => void;
+    readonly __wasm_bindgen_func_elem_6510: (a: number, b: number, c: number, d: number) => void;
+    readonly __wasm_bindgen_func_elem_2366: (a: number, b: number, c: number) => number;
+    readonly __wasm_bindgen_func_elem_2367: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_2367_112: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_2367_113: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_2367_114: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_2367_115: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_2367_116: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_2367_117: (a: number, b: number, c: number) => void;
     readonly __wbindgen_export: (a: number, b: number) => number;
     readonly __wbindgen_export2: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_export3: (a: number) => void;

package/dist/net_leaf.js

@@ -2718,7 +2718,7 @@ function __wbg_get_imports() {
             const ret = getObject(arg0).error;
             return isLikeNone(ret) ? 0 : addHeapObject(ret);
         },
-        __wbg_error_4c50581549efd2db: function(arg0, arg1) {
+        __wbg_error_5b007554bf198f44: function(arg0, arg1) {
             console.error(getStringFromWasm0(arg0, arg1));
         },
         __wbg_error_6a23b57453026a47: function() { return handleError(function (arg0) {
@@ -2914,7 +2914,7 @@ function __wbg_get_imports() {
                     const a = state0.a;
                     state0.a = 0;
                     try {
-                        return __wasm_bindgen_func_elem_6506(a, state0.b, arg0, arg1);
+                        return __wasm_bindgen_func_elem_6510(a, state0.b, arg0, arg1);
                     } finally {
                         state0.a = a;
                     }
@@ -2956,7 +2956,7 @@ function __wbg_get_imports() {
                     const a = state0.a;
                     state0.a = 0;
                     try {
-                        return __wasm_bindgen_func_elem_6506(a, state0.b, arg0, arg1);
+                        return __wasm_bindgen_func_elem_6510(a, state0.b, arg0, arg1);
                     } finally {
                         state0.a = a;
                     }
@@ -3266,47 +3266,47 @@ function __wbg_get_imports() {
         },
         __wbindgen_generic_0000000000000001: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 34, ret: Externref, inner_ret: Some(Externref) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2365);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000002: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 35, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2367);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000003: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 867, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_6504);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_6508);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000004: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("CloseEvent")], shim_idx: 35, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366_112);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2367_112);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000005: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("Event")], shim_idx: 35, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366_113);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2367_113);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000006: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("MessageEvent")], shim_idx: 35, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366_114);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2367_114);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000007: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("RTCDataChannelEvent")], shim_idx: 35, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366_115);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2367_115);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000008: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("RTCPeerConnectionIceErrorEvent")], shim_idx: 35, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366_116);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2367_116);
             return addHeapObject(ret);
         },
         __wbindgen_generic_0000000000000009: function(arg0, arg1) {
             // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("RTCPeerConnectionIceEvent")], shim_idx: 35, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2366_117);
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_2367_117);
             return addHeapObject(ret);
         },
         __wbindgen_generic_000000000000000a: function(arg0) {
@@ -3333,47 +3333,47 @@ function __wbg_get_imports() {
     };
 }
 
-function __wasm_bindgen_func_elem_2366(arg0, arg1, arg2) {
-    wasm.__wasm_bindgen_func_elem_2366(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2367(arg0, arg1, arg2) {
+    wasm.__wasm_bindgen_func_elem_2367(arg0, arg1, addHeapObject(arg2));
 }
 
-function __wasm_bindgen_func_elem_2366_112(arg0, arg1, arg2) {
-    wasm.__wasm_bindgen_func_elem_2366_112(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2367_112(arg0, arg1, arg2) {
+    wasm.__wasm_bindgen_func_elem_2367_112(arg0, arg1, addHeapObject(arg2));
 }
 
-function __wasm_bindgen_func_elem_2366_113(arg0, arg1, arg2) {
-    wasm.__wasm_bindgen_func_elem_2366_113(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2367_113(arg0, arg1, arg2) {
+    wasm.__wasm_bindgen_func_elem_2367_113(arg0, arg1, addHeapObject(arg2));
 }
 
-function __wasm_bindgen_func_elem_2366_114(arg0, arg1, arg2) {
-    wasm.__wasm_bindgen_func_elem_2366_114(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2367_114(arg0, arg1, arg2) {
+    wasm.__wasm_bindgen_func_elem_2367_114(arg0, arg1, addHeapObject(arg2));
 }
 
-function __wasm_bindgen_func_elem_2366_115(arg0, arg1, arg2) {
-    wasm.__wasm_bindgen_func_elem_2366_115(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2367_115(arg0, arg1, arg2) {
+    wasm.__wasm_bindgen_func_elem_2367_115(arg0, arg1, addHeapObject(arg2));
 }
 
-function __wasm_bindgen_func_elem_2366_116(arg0, arg1, arg2) {
-    wasm.__wasm_bindgen_func_elem_2366_116(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2367_116(arg0, arg1, arg2) {
+    wasm.__wasm_bindgen_func_elem_2367_116(arg0, arg1, addHeapObject(arg2));
 }
 
-function __wasm_bindgen_func_elem_2366_117(arg0, arg1, arg2) {
-    wasm.__wasm_bindgen_func_elem_2366_117(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2367_117(arg0, arg1, arg2) {
+    wasm.__wasm_bindgen_func_elem_2367_117(arg0, arg1, addHeapObject(arg2));
 }
 
-function __wasm_bindgen_func_elem_2365(arg0, arg1, arg2) {
-    const ret = wasm.__wasm_bindgen_func_elem_2365(arg0, arg1, addHeapObject(arg2));
+function __wasm_bindgen_func_elem_2366(arg0, arg1, arg2) {
+    const ret = wasm.__wasm_bindgen_func_elem_2366(arg0, arg1, addHeapObject(arg2));
     return takeObject(ret);
 }
 
-function __wasm_bindgen_func_elem_6506(arg0, arg1, arg2, arg3) {
-    wasm.__wasm_bindgen_func_elem_6506(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
+function __wasm_bindgen_func_elem_6510(arg0, arg1, arg2, arg3) {
+    wasm.__wasm_bindgen_func_elem_6510(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
 }
 
-function __wasm_bindgen_func_elem_6504(arg0, arg1, arg2) {
+function __wasm_bindgen_func_elem_6508(arg0, arg1, arg2) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        wasm.__wasm_bindgen_func_elem_6504(retptr, arg0, arg1, addHeapObject(arg2));
+        wasm.__wasm_bindgen_func_elem_6508(retptr, arg0, arg1, addHeapObject(arg2));
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         if (r1) {

package/dist/net_leaf_bg.wasm.d.ts

@@ -119,16 +119,16 @@ export const proxystream_peer_node_hex: (a: number, b: number) => void;
 export const proxystream_send: (a: number, b: number) => number;
 export const proxystream_stream_id_hex: (a: number, b: number) => void;
 export const start: () => void;
-export const __wasm_bindgen_func_elem_6504: (a: number, b: number, c: number, d: number) => void;
-export const __wasm_bindgen_func_elem_6506: (a: number, b: number, c: number, d: number) => void;
-export const __wasm_bindgen_func_elem_2365: (a: number, b: number, c: number) => number;
-export const __wasm_bindgen_func_elem_2366: (a: number, b: number, c: number) => void;
-export const __wasm_bindgen_func_elem_2366_112: (a: number, b: number, c: number) => void;
-export const __wasm_bindgen_func_elem_2366_113: (a: number, b: number, c: number) => void;
-export const __wasm_bindgen_func_elem_2366_114: (a: number, b: number, c: number) => void;
-export const __wasm_bindgen_func_elem_2366_115: (a: number, b: number, c: number) => void;
-export const __wasm_bindgen_func_elem_2366_116: (a: number, b: number, c: number) => void;
-export const __wasm_bindgen_func_elem_2366_117: (a: number, b: number, c: number) => void;
+export const __wasm_bindgen_func_elem_6508: (a: number, b: number, c: number, d: number) => void;
+export const __wasm_bindgen_func_elem_6510: (a: number, b: number, c: number, d: number) => void;
+export const __wasm_bindgen_func_elem_2366: (a: number, b: number, c: number) => number;
+export const __wasm_bindgen_func_elem_2367: (a: number, b: number, c: number) => void;
+export const __wasm_bindgen_func_elem_2367_112: (a: number, b: number, c: number) => void;
+export const __wasm_bindgen_func_elem_2367_113: (a: number, b: number, c: number) => void;
+export const __wasm_bindgen_func_elem_2367_114: (a: number, b: number, c: number) => void;
+export const __wasm_bindgen_func_elem_2367_115: (a: number, b: number, c: number) => void;
+export const __wasm_bindgen_func_elem_2367_116: (a: number, b: number, c: number) => void;
+export const __wasm_bindgen_func_elem_2367_117: (a: number, b: number, c: number) => void;
 export const __wbindgen_export: (a: number, b: number) => number;
 export const __wbindgen_export2: (a: number, b: number, c: number, d: number) => number;
 export const __wbindgen_export3: (a: number) => void;

package/dist/node.d.ts

@@ -257,6 +257,19 @@ export interface ConnectOptions extends WasmSource {
      * an entity but not a static key.
      */
     noiseSecretHex?: string;
+    /**
+     * Hold this identity exclusively while the node is open (default
+     * `true`; only read with {@link ConnectOptions.entitySecretHex}).
+     *
+     * Two tabs connected as the same node evict each other at the anchor,
+     * so stores and lobbies in both flap — the hazard `openSession()`
+     * avoids by electing one leader. `connect()` takes a Web Lock named
+     * after a hash of the identity (never the secret) and refuses a second
+     * holder with an {@link IdentityError} instead; `close()` releases it.
+     * Where Web Locks are unavailable the lock is skipped. Pass `false` to
+     * run without it (SDK audit 2026-10-11).
+     */
+    lockIdentity?: boolean;
     /**
      * The `rtc_addr` the anchor publishes, supplied out of band.
      *
@@ -312,6 +325,8 @@ export declare class BrowserNode {
     private anchorRtcAddrs;
     /** Set once the leaf reports a session — a bootstrap that demonstrably worked. */
     private bootstrapObserved;
+    /** Releases the identity's Web Lock (`connect({ lockIdentity })`). */
+    private releaseIdentity;
     /** This node's mesh id, hex. */
     nodeIdHex(): string;
     /** The anchor's mesh id, hex. */

package/dist/node.js

@@ -83,6 +83,12 @@ export class BrowserNode {
     anchorRtcAddrs = [];
     /** Set once the leaf reports a session — a bootstrap that demonstrably worked. */
     bootstrapObserved = false;
+    /** Releases the identity's Web Lock (`connect({ lockIdentity })`). */
+    releaseIdentity = null;
+    /** @internal — `connect()` hands over the identity lock it took. */
+    releaseIdentityOnClose(release) {
+        this.releaseIdentity = release;
+    }
     /** @internal — use {@link connect}. */
     constructor(inner, bootstrapUrl, failureTyping, anchorRtcAddr) {
         this.inner = inner;
@@ -787,6 +793,10 @@ export class BrowserNode {
         if (this.closed)
             return;
         this.closed = true;
+        // Whatever else fails below, the identity is free for another tab.
+        const releaseIdentity = this.releaseIdentity;
+        this.releaseIdentity = null;
+        queueMicrotask(() => releaseIdentity?.());
         const failures = [];
         // Ownership retirement first, while the node can still put a
         // CANCEL on the wire (plan §4.5): one per dropped caller handle,
@@ -851,11 +861,17 @@ export async function connect(options) {
     const request = buildConnectRequest(options);
     const failureTyping = options.failureTyping ?? {};
     const wasm = await loadLeafWasm(options);
+    const release = request.entitySecretHex !== undefined && options.lockIdentity !== false
+        ? await lockIdentity(request.entitySecretHex)
+        : null;
     try {
         const inner = await wasm.LeafNode.connect(request);
-        return new BrowserNode(inner, options.bootstrapUrl ?? null, failureTyping, options.anchorRtcAddr ?? null);
+        const node = new BrowserNode(inner, options.bootstrapUrl ?? null, failureTyping, options.anchorRtcAddr ?? null);
+        node.releaseIdentityOnClose(release);
+        return node;
     }
     catch (error) {
+        release?.();
         throw await refineIceFailure(fromWasmError(error), {
             bootstrapUrl: options.bootstrapUrl ?? null,
             bootstrapObserved: false,
@@ -864,6 +880,64 @@ export async function connect(options) {
         });
     }
 }
+/**
+ * The Web Lock name for one custodial identity, or `null` where
+ * `crypto.subtle` is unavailable. A hash of the secret, never the secret.
+ *
+ * Shared by `connect()` and `openSession()`: a session with a custodial
+ * secret names its election lock with this too, so a `connect()` tab and
+ * an `openSession()` tab given one secret contend for ONE lock instead of
+ * each running a node with that identity (cubic review of PR #1228).
+ *
+ * @internal
+ */
+export async function identityLockName(entitySecretHex) {
+    const subtle = globalThis.crypto?.subtle;
+    if (subtle === undefined)
+        return null;
+    // Lowercased: the secret parses case-insensitively, so "AB…" and "ab…" are
+    // one identity and must contend for one lock (code review 2026-10-11,
+    // BROWSER-3).
+    const canonical = entitySecretHex.toLowerCase();
+    const digest = new Uint8Array(await subtle.digest('SHA-256', new TextEncoder().encode(`net-mesh:identity:${canonical}`)));
+    return `net-mesh:identity:${Array.from(digest.subarray(0, 16), b => b.toString(16).padStart(2, '0')).join('')}`;
+}
+/**
+ * Take the exclusive Web Lock for one custodial identity, or throw an
+ * {@link IdentityError} when another tab or window holds it. Returns the
+ * release, or `null` where Web Locks (or `crypto.subtle`, for the hashed
+ * name) are unavailable.
+ */
+async function lockIdentity(entitySecretHex) {
+    const locks = globalThis.navigator?.locks;
+    if (locks === undefined)
+        return null;
+    const name = await identityLockName(entitySecretHex);
+    if (name === null)
+        return null;
+    const acquired = await new Promise((resolve, reject) => {
+        let release;
+        const held = new Promise(done => {
+            release = done;
+        });
+        locks
+            .request(name, { ifAvailable: true }, async (lock) => {
+            if (lock === null) {
+                resolve('busy');
+                return;
+            }
+            resolve(release);
+            await held;
+        })
+            .catch(reject);
+    });
+    if (acquired === 'busy') {
+        throw new IdentityError('this identity is already connected in another tab or window of this browser; ' +
+            'two nodes with one identity evict each other at the anchor (use openSession() to share one ' +
+            'node across tabs, or pass lockIdentity: false)');
+    }
+    return acquired;
+}
 /**
  * Build exactly the options object `LeafNode.connect` reads, credential
  * resolved, origin defaulted, custodial identity validated.

package/dist/store/host.js

@@ -64,16 +64,22 @@ export const FAREWELL_DEADLINE_MS = 500;
 export function peerHexOf(peer) {
     const decimal = /^\d+$/.test(peer);
     const hex = /^(0x)?[0-9a-f]{1,16}$/i.test(peer);
+    let out;
     try {
         if (decimal)
-            return BigInt(peer).toString(16).padStart(16, '0');
-        if (hex)
-            return BigInt(peer.startsWith('0x') ? peer : `0x${peer}`).toString(16).padStart(16, '0');
+            out = BigInt(peer).toString(16).padStart(16, '0');
+        else if (hex)
+            out = BigInt(peer.startsWith('0x') ? peer : `0x${peer}`).toString(16).padStart(16, '0');
+        else
+            return null;
     }
     catch {
         return null;
     }
-    return null;
+    // A decimal above u64 renders as 17+ hex digits: no node has that id, so
+    // it is not one — `kick('18446744073709551616')` used to target nobody
+    // without an error (cubic review of PR #1228).
+    return out.length === 16 ? out : null;
 }
 /**
  * A node id the CALLER holds, in the same spelling: 16 lowercase hex.

package/dist/store/join.js

@@ -119,6 +119,14 @@ export function joinStore(options) {
     let closed = false;
     let upstream = null;
     let opening = null;
+    /**
+     * Bumped by `reconnect()`. An open started under an older epoch belongs
+     * to the lost session: it never publishes `upstream` and never clears a
+     * newer `opening`, so `reconnect()` can start fresh instead of inheriting
+     * that open's late rejection — or waiting on one that never settles
+     * (code review 2026-10-11, BROWSER-2).
+     */
+    let openEpoch = 0;
     const readyWaiters = [];
     /** The transition in flight and its callers (§2). */
     let transition = null;
@@ -141,6 +149,7 @@ export function joinStore(options) {
         // the relay is installed before the direct half is even tried, so
         // the open below is the thing that decides, and its refusal is
         // typed.
+        const epoch = openEpoch;
         opening = Promise.resolve(options.transport.connectPeer?.(hostHex))
             .catch(() => undefined)
             .then(() => options.transport.openStream({
@@ -149,6 +158,16 @@ export function joinStore(options) {
             label: streamId,
         }))
             .then(open => {
+            if (epoch !== openEpoch) {
+                // Superseded by `reconnect()`: reclaim, never publish.
+                try {
+                    open.close();
+                }
+                catch {
+                    // Already gone.
+                }
+                throw new StoreError('aborted', 'the stream open was superseded by reconnect()');
+            }
             opening = null;
             // An open that resolves after `close()` is reclaimed, never
             // published.
@@ -170,7 +189,8 @@ export function joinStore(options) {
             // answered from it with the same stale error until the caller
             // happens to call `reconnect()`. A transient failure is a retry,
             // not a verdict on the peer.
-            opening = null;
+            if (epoch === openEpoch)
+                opening = null;
             throw error;
         });
         return opening;
@@ -669,9 +689,25 @@ export function joinStore(options) {
         reconnect: async () => {
             if (closed)
                 throw new StoreError('closed', 'this store handle is closed');
-            // The old stream belongs to the lost session.
+            // The old stream belongs to the lost session: CLOSE it, never just
+            // drop it — a dropped LeafStream stays registered with the node and
+            // its wasm listener, so every reconnect leaked one (SDK audit
+            // 2026-10-11). An open still in flight is detached by the epoch
+            // bump: it can no longer overwrite the new stream (it is closed on
+            // arrival instead), and this reconnect no longer inherits its
+            // rejection or its hang.
+            const old = upstream;
             upstream = null;
+            openEpoch += 1;
             opening = null;
+            if (old !== null) {
+                try {
+                    old.close();
+                }
+                catch {
+                    // Already gone with its session.
+                }
+            }
             let requests;
             try {
                 requests = replica.reconnect();

package/dist/store/owner.d.ts

@@ -39,6 +39,15 @@ import { type Hex } from './wire.js';
 export declare const MAX_PENDING_ACTIONS = 32;
 /** Handles one owner will hold (brief §2). */
 export declare const MAX_HANDLES = 256;
+/**
+ * Handles one authenticated peer may hold at once. Room for siblings and
+ * for a reconnect that overlaps its predecessor's lease, but never the
+ * whole table: one peer could otherwise take all {@link MAX_HANDLES} and
+ * lock every other player out — the lobby's capacity rule counts distinct
+ * peers, so a seated player's repeat joins bypassed it (SDK audit
+ * 2026-10-11).
+ */
+export declare const MAX_HANDLES_PER_PEER = 16;
 /** How long a handle lives without an accepted authenticated message. */
 export declare const HANDLE_LEASE_MS = 60000;
 /** What the owner needs from its host. */
@@ -189,6 +198,8 @@ export interface OwnerHandle {
     /** The authenticated peer this handle is bound to (§1.3). */
     readonly peer: string;
     readonly audience: readonly string[];
+    /** The opaque key the `join` carried; every read decision passes it on. */
+    readonly key?: string;
     /** Highest generation allocated for this handle; monotone (§1.7a). */
     readonly generation: number;
     /**